Just to be clear, it's explicitly not an SSL replacement. It's a replacement for CAs, with the explicit design goal of not forcing some giant IPv6-like "change the world" rollout. It's based in large part on earlier work on solving the SSH Host Key validation problem - see http://www.usenix.org/event/usenix08/tech/full_papers/wendlandt/wendlandt_html/
In Convergence, there are some number of network topologically distant "Notary" services, run by a diverse collection of different organizations. The (self-signed) SSL certs for each of the Notary endpoints are baked into the browser. When the browser hits an https site for the first time, it fetches the cert and then dials out to all N of its Notaries, and says "I went to talk to www.example.com:443 and got back this SSL cert. Is it good?". The Notaries issues a yay or nay. If all the Notaries say "yay", the browser caches the cert up to the cert's natural expiration date. On subsequent requests to www.example.com:443, the browser compares its cache against the cert it just received. If there's a mismatch, it dials back out to the Notaries again. Since sites don't do cert rotation that often, and browsers can do super-aggressive cert caching (and key-rotated certs get cleanly invalidated from the cache), it's not an inherently un-scalable solution.
The Notaries are free to set whatever policy they want for what constitutes a good or bad cert. The suggested ones are "Notary's servers poll site", "Notary consults the EFF SSL Certificate Observatory", "Notary checks for what cert is on file in DNSSEC", or even "Notary does traditional CA validation".
I think it's the most unintrusive solution to the CA problem ever. Aside from convincing MS/Apple/Google/Mozilla to jump on it (and the Citibank problem), there were two issues that bugged me.
First one is captive portals (e.g., airport or hotel wifi). He handwaved past that a bit, and proposed using DNS as a fallback protocol to communicate with the Notaries. But, there are numerous captive portals that'll just eat DNS records other than A & CNAME.
Second one is what's the financial incentive to run a Notary? To scale, there are going to have to be tons of these things. Some orgs might run them out of the kindness of their hearts, much as DNS roots are done, but I think the architecture of DNS scales quite a bit better than Convergence.